Commit f7ac552b authored by Ihor Solodrai's avatar Ihor Solodrai Committed by Alexei Starovoitov
Browse files

selftests/bpf: Fix use-after-free in xdp_metadata test 



ASAN reported a use-after-free in close_xsk().

The xsk->socket internally references xsk->umem via socket->ctx->umem,
so the socket must be deleted before the umem. Fix the order of
operations in close_xsk().

Acked-by: default avatarMykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: default avatarIhor Solodrai <ihor.solodrai@linux.dev>
Link: https://lore.kernel.org/r/20260223190736.649171-14-ihor.solodrai@linux.dev


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent ff951141

tools/testing/selftests/bpf/prog_tests/xdp_metadata.c

+2 −2
Original line number Diff line number Diff line
@@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk) 


static void close_xsk(struct xsk *xsk)

{

	if (xsk->umem)

		xsk_umem__delete(xsk->umem);

	if (xsk->socket)

		xsk_socket__delete(xsk->socket);

	if (xsk->umem)

		xsk_umem__delete(xsk->umem);

	munmap(xsk->umem_area, UMEM_SIZE);

}